Except where noted, everything here applies to both Firefox 136 and the Firefox 128.8 [[Firefox ESR release cycle|ESR]]. __TOC__ =Bug Fixes= *In some cases, Microsoft Entra SSO failed due to missing headers. This was fixed in [https://bugzilla.mozilla.org/show_bug.cgi?id=1945596 bug 1945596]. =Other Changes= *[[HTTPS-First upgrades to secure connections|HTTPS-First]] is now on by default. You can manage this behavior using the [https://mozilla.github.io/policy-templates/#httpsonlymode HttpsOnlyMode] and [https://mozilla.github.io/policy-templates/#httpallowlist HttpAllowlist] policies. *The new preference {pref network.http.basic_http_auth.enabled} allows you to completely disable Basic HTTP authentication. =Policies= *The [https://mozilla.github.io/policy-templates/#extensionsettings ExtensionSettings] policy has been updated to allow extensions to be enabled in private windows. =Special Notes= ==Firefox ESR 115== Support for the Firefox 115 ESR has been extended to September 2025 to accomodate legacy Windows and Mac users.

Except where noted, everything here applies to both Firefox 136 and the Firefox 128.8 ESR.

Bug Fixes

• In some cases, Microsoft Entra SSO failed due to missing headers. This was fixed in bug 1945596.

Other Changes

• HTTPS-First is now on by default. You can manage this behavior using the HttpsOnlyMode and HttpAllowlist policies.
• The new preference network.http.basic_http_auth.enabled allows you to completely disable Basic HTTP authentication.

Policies

• The ExtensionSettings policy has been updated to allow extensions to be enabled in private windows.

Special Notes

Firefox ESR 115

Support for the Firefox 115 ESR has been extended to September 2025 to accomodate legacy Windows and Mac users.